{
  "type": "tweet",
  "id": "2000948555599802632",
  "url": "https://x.com/omarsar0/status/2000948555599802632",
  "twitterUrl": "https://twitter.com/omarsar0/status/2000948555599802632",
  "text": "This multi-agent system outperforms 9 of 10 human penetration testers.\n\nThis work presents the first comprehensive evaluation of AI agents against human cybersecurity professionals on a real enterprise network: approximately 8,000 hosts across 12 subnets at a major research university.\n\nIt introduces ARTEMIS, a multi-agent framework featuring dynamic prompt generation, arbitrary sub-agents running in parallel, and automatic vulnerability triaging.\n\nARTEMIS placed second overall, discovering 9 valid vulnerabilities with an 82% valid submission rate. It outperformed 9 of 10 human penetration testers in the study.\n\nHow does it work? A supervisor agent manages the workflow, spawning specialized sub-agents with dynamically generated expert prompts for each task. When the agent finds something noteworthy from a scan, it immediately launches parallel sub-agents to probe multiple targets simultaneously. A triage module verifies submissions are reproducible before reporting.\n\nThis parallelism is a key advantage humans lack. One participant noted a vulnerable LDAP server during scanning, but never returned to it. ARTEMIS would have assigned a sub-agent to investigate while continuing other work.\n\nThe cost implications are significant. ARTEMIS with GPT-5 costs $18/hour versus the industry average of $60/hour for professional penetration testers. At equivalent performance to most human professionals, that's a 3x cost reduction.\n\nOn the other hand, ARTEMIS struggles with GUI-based tasks: 80% of humans found a remote code execution vulnerability via TinyPilot's web interface, but the agent couldn't navigate the GUI. It also has higher false-positive rates, sometimes misinterpreting HTTP 200 responses as successful authentication when they were actually redirect pages.\n\nThis shows the reality of how much work there is to do on computer-using agents.\n\nNo humans found a vulnerability in an older IDRAC server with outdated HTTPS ciphers that browsers refused to load. ARTEMIS exploited it using curl -k to bypass certificate verification.\n\nPaper: https://t.co/xuuqZLuH6j\n\nLearn to build effective AI agents in our academy: https://t.co/JBU5beIoD0",
  "source": "Twitter for iPhone",
  "retweetCount": 6,
  "replyCount": 1,
  "likeCount": 20,
  "quoteCount": 1,
  "viewCount": 1712,
  "createdAt": "Tue Dec 16 15:18:06 +0000 2025",
  "lang": "en",
  "bookmarkCount": 29,
  "isReply": false,
  "inReplyToId": null,
  "conversationId": "2000948555599802632",
  "displayTextRange": [
    0,
    275
  ],
  "inReplyToUserId": null,
  "inReplyToUsername": null,
  "author": {
    "type": "user",
    "userName": "omarsar0",
    "url": "https://x.com/omarsar0",
    "twitterUrl": "https://twitter.com/omarsar0",
    "id": "3448284313",
    "name": "elvis",
    "isVerified": false,
    "isBlueVerified": true,
    "verifiedType": null,
    "profilePicture": "https://pbs.twimg.com/profile_images/939313677647282181/vZjFWtAn_normal.jpg",
    "coverPicture": "https://pbs.twimg.com/profile_banners/3448284313/1565974901",
    "description": "",
    "location": "DAIR.AI Academy",
    "followers": 279552,
    "following": 736,
    "status": "",
    "canDm": true,
    "canMediaTag": true,
    "createdAt": "Fri Sep 04 12:59:26 +0000 2015",
    "entities": {
      "description": {
        "urls": []
      },
      "url": {}
    },
    "fastFollowersCount": 0,
    "favouritesCount": 33970,
    "hasCustomTimelines": true,
    "isTranslator": true,
    "mediaCount": 4385,
    "statusesCount": 16755,
    "withheldInCountries": [],
    "affiliatesHighlightedLabel": {},
    "possiblySensitive": false,
    "pinnedTweetIds": [
      "2000626975296405525"
    ],
    "profile_bio": {
      "description": "Building @dair_ai • Prev: Meta AI, Elastic, PhD • New cohort: https://t.co/GZMhf39NRs",
      "entities": {
        "description": {
          "urls": [
            {
              "display_url": "dair-ai.thinkific.com/courses/claude…",
              "expanded_url": "https://dair-ai.thinkific.com/courses/claude-code-for-everyone-2",
              "indices": [
                62,
                85
              ],
              "url": "https://t.co/GZMhf39NRs"
            }
          ],
          "user_mentions": [
            {
              "id_str": "0",
              "indices": [
                9,
                17
              ],
              "name": "",
              "screen_name": "dair_ai"
            }
          ]
        },
        "url": {
          "urls": [
            {
              "display_url": "dair.ai",
              "expanded_url": "https://www.dair.ai/",
              "indices": [
                0,
                23
              ],
              "url": "https://t.co/XQto5ypkSM"
            }
          ]
        }
      }
    },
    "isAutomated": false,
    "automatedBy": null
  },
  "extendedEntities": {
    "media": [
      {
        "display_url": "pic.twitter.com/A8edtnYqcs",
        "expanded_url": "https://twitter.com/omarsar0/status/2000948555599802632/photo/1",
        "ext_media_availability": {
          "status": "Available"
        },
        "features": {
          "large": {},
          "orig": {}
        },
        "id_str": "2000948551816503301",
        "indices": [
          276,
          299
        ],
        "media_key": "3_2000948551816503301",
        "media_results": {
          "id": "QXBpTWVkaWFSZXN1bHRzOgwAAQoAARvEzBs82uAFCgACG8TMHB5bcQgAAA==",
          "result": {
            "__typename": "ApiMedia",
            "id": "QXBpTWVkaWE6DAABCgABG8TMGzza4AUKAAIbxMwcHltxCAAA",
            "media_key": "3_2000948551816503301"
          }
        },
        "media_url_https": "https://pbs.twimg.com/media/G8TMGzza4AUy8bX.jpg",
        "original_info": {
          "focus_rects": [
            {
              "h": 984,
              "w": 1758,
              "x": 0,
              "y": 0
            },
            {
              "h": 1312,
              "w": 1312,
              "x": 223,
              "y": 0
            },
            {
              "h": 1312,
              "w": 1151,
              "x": 304,
              "y": 0
            },
            {
              "h": 1312,
              "w": 656,
              "x": 551,
              "y": 0
            },
            {
              "h": 1312,
              "w": 1758,
              "x": 0,
              "y": 0
            }
          ],
          "height": 1312,
          "width": 1758
        },
        "sizes": {
          "large": {
            "h": 1312,
            "w": 1758
          }
        },
        "type": "photo",
        "url": "https://t.co/A8edtnYqcs"
      }
    ]
  },
  "card": null,
  "place": {},
  "entities": {
    "urls": [
      {
        "display_url": "arxiv.org/abs/2512.09882",
        "expanded_url": "https://arxiv.org/abs/2512.09882",
        "indices": [
          2063,
          2086
        ],
        "url": "https://t.co/xuuqZLuH6j"
      },
      {
        "display_url": "dair-ai.thinkific.com",
        "expanded_url": "https://dair-ai.thinkific.com/",
        "indices": [
          2139,
          2162
        ],
        "url": "https://t.co/JBU5beIoD0"
      }
    ]
  },
  "quoted_tweet": null,
  "retweeted_tweet": null,
  "isLimitedReply": false,
  "article": null
}